Shutdown Event Tracker

Shutdown Event Tracker is a tool that prompts users to record a reason why they restart or shut down the computer. This information is available for review in the event log. If a computer running Windows 7 is connected to a domain that uses monitoring tools, you can collect this information as part of network reporting.

When Shutdown Event Tracker is enabled, users cannot shut down or restart the computer without providing a reason. If the computer is shut down or restarted unexpectedly, either as a result of power interruption or hardware failure, the user is prompted to enter a reason in Shutdown Event Tracker when the computer is started again.

See the following topics for more information about using Shutdown Event Tracker.

  • Shutdown Event Tracker Overview

  • Work with Shutdown Event Tracker


Shutdown Event Tracker Overview

Shutdown Event Tracker provides a way for IT professionals to consistently track why users restart or shut down their computers. It does not document why users choose other options, such as Log off or Hibernate. It gathers the reasons users provide for restarts and shutdowns to help create a comprehensive picture of an organization's system environment. Shutdown event tracker is disabled by default on computers running Windows 7.

"Expected" and "unexpected" restarts and shutdowns

When Shutdown Event Tracker is enabled, the “expected” shutdown dialog box appears when you click Start and then Shutdown, when you press ALT+F4 at the desktop, or when you press CTRL+ALT+DELETE and then click Shutdown or Restart. This introduces a step in the shutdown process that prompts you to supply a reason and a comment to explain the action. An expected restart or shutdown provides the operating system time to complete its usual shutdown routine. By contrast, the computer cannot anticipate an "unexpected" restart or shutdown. If Shutdown Event Tracker is enabled, the unexpected shutdown dialog box appears to the first person with membership in the local Users group who logs on to the computer after the restart or shutdown. Like the expected shutdown dialog box, it prompts this user to supply a reason and a comment.

Planned and unplanned restarts and shutdowns

An expected system restart or shutdown can be planned or unplanned. When you have control over the timing of a restart or shutdown, the task is planned. For example, the IT department may reserve a specific time at which to install new applications. By contrast, an unplanned restart or shutdown forces you to immediately perform the task. For example, an unresponsive application might suddenly force you to restart the computer.

Unexpected restarts or shutdowns can also be planned or unplanned. For example, users sometimes choose to shut down their computers by pressing the power button instead of clicking Start and then Shutdown, or pressing CTRL+ALT+DELETE and then clicking Shutdown. In this case, the shutdown is unexpected by the computer and planned by the user. However, if the computer's power cord is accidentally disconnected, the shutdown is both unexpected and unplanned. In each case, the unexpected dialog box appears to the first person with shutdown user rights to log on to the computer after the event.

Local and remote restarts and shutdowns

You can use Shutdown Event Tracker and the Shutdown.exe command-line tool to restart or shut down a local computer and one or more remote computers. Additionally, IT professionals can perform remote bulk annotations of unexpected shutdowns, an alternative to the time-consuming task of logging on to each computer to record a reason for an unexpected shutdown.

Root cause analysis of restarts and shutdowns

Shutdown Event Tracker records the reason for each restart or shutdown through the Event Log service. You can use Event Viewer to open the system log and look for a pattern of events to find the cause of frequent system restarts and shutdowns. For more information about using Event Viewer, see http://go.microsoft.com/fwlink/?LinkId=144403.

Additional references

  • Work with Shutdown Event Tracker


Work with Shutdown Event Tracker

You can use the data provided by Shutdown Event Tracker to create a more complete picture of your system environment. To identify patterns of computer restarts and shutdowns, review the event logs in Event Viewer on a regular basis. This information serves as a starting point for isolating system problems. For more information about Event Viewer, see http://go.microsoft.com/fwlink/?LinkId=144403.

  • Configure Shutdown Event Tracker on the Local Computer

  • Restart or Shut Down the Local Computer and Document the Reason

  • Restart or Shut Down a Remote Computer and Document the Reason

  • Cancel a Restart or Shutdown

  • Document the Reason for an Unexpected Restart or Shutdown of the Local Computer

  • Document the Reason for the Unexpected Restart or Shutdown of a Remote Computer

  • Enable the Remote Registry Service


Configure Shutdown Event Tracker on the Local Computer

When Shutdown Event Tracker is enabled, users cannot shut down or restart the computer without providing a reason. If the computer is shut down or restarted unexpectedly, either as a result of power interruption or hardware failure, the first member of the local Users group to log in after the restart is prompted to enter a reason in Shutdown Event Tracker.

Shutdown Event Tracker can be enabled on the local computer by editing the local computer's Group Policy settings.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To enable Shutdown Event Tracker in Group Policy

  1. Click Start, click in the Search box, and type gpedit.msc.

    The Group Policy Object Editor dialog box appears.

  2. In the Local Computer Policy navigation pane, expand Computer Configuration, expand Administrative Templates, and click System.

  3. In the console pane, scroll down to the list of objects, right-click Display Shutdown Event Tracker, and click Properties.

  4. On the Settings tab, click Enabled.

  5. In the drop-down box, click Always, and then click OK.

    Note

    The Server Only and Workstation Only settings are intended for use by a domain administrator.

Additional considerations

  • To perform this procedure, you must be a member of the local Administrators group or equivalent.

  • If multiple people use the computer where Shutdown Event Tracker is enabled, consider establishing guidelines for how reasons are documented, such as entering the name of the application in the comment field any time a restart is required due to the installation of a new program.

Additional references

  • Work with Shutdown Event Tracker


Restart or Shut Down the Local Computer and Document the Reason

When Shutdown Event Tracker is enabled, you will be required to provide a reason when you restart or shut down the computer.

Membership in the local Users group, or equivalent, is the minimum required to complete this procedure.

To restart or shut down the local computer and document the reason

  1. Click Start, click the arrow to the right of the Lock icon, and click Restart or Shut Down.

  2. If you did not anticipate having to restart or shut down the computer at this time, clear the Planned check box.

  3. In the drop-down list, select the appropriate reason for the restart or shutdown, and then click OK.

    Note

    If a comment is required, the OK button will not be available until you type at least one character in the text box.
Important

If your computer does not turn off automatically, do not turn off your computer until a message appears telling you that it is safe to do so. The operating system stores important data in memory while the system is running and needs to write the data to the hard disk before you turn off the computer. After the data is saved, the operating system either turns the computer off itself, or notifies you that it is safe to turn off the computer.

Additional considerations

  • You can also restart or shut down your computer and document the reason from the command line. For help using the shutdown command, type shutdown /? at the command prompt.

  • Another way to restart or shut down your computer and document the reason is to press ALT+F4 when the desktop is selected.

Additional references

  • Work with Shutdown Event Tracker

  • Shutdown Event Tracker Overview


Restart or Shut Down a Remote Computer and Document the Reason

In order to use this feature, the Remote Registry service must be enabled on the remote computer. See Enable the Remote Registry Service for more information.

Access to the Remote Registry or membership in the Administrators group on the remote computer is the minimum required to complete this procedure.

  • Using the Windows interface

  • Using a command line

Using the Windows interface

To restart or shut down a remote computer and document the reason using the Windows interface

  1. Click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type shutdown /i to display the Remote Shutdown dialog box (Shutdown.exe).

  3. Under Computers, click Add to enter computer names, or click Browse to open the Find Computers dialog box.

  4. Under What do you want these computers to do, click Restart or Shut down.

  5. Select the appropriate reason for the restart or shutdown from the list.

    Note

    If a comment is required, the OK button will not be available until you type at least one character in the text box.

Additional considerations

  • Another way to start Command Prompt is to click Start, click in the Search box, type cmd, and press ENTER.

  • The Remote Registry service must be enabled on the remote computer for Shutdown Event Tracker to record information.

  • To shut down or restart a remote computer, the Remote Administration and Windows Management Instrumentation firewall exceptions must be enabled on the remote computer.

Additional references

  • Work with Shutdown Event Tracker

  • Shutdown Event Tracker Overview

  • Enable the Remote Registry Service

Using a command line

Membership in the Administrators group, or equivalent, on the remote computer is the minimum required to complete this procedure.

To restart or shut down a remote computer and document the reason using the command line

  1. Click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type shutdown /[r|s] /m \\ComputerName /c "Comment" /d [u|p] <xx>:<yy> and then press ENTER.

Value Description

/r

Restarts the remote computer.

/s

Shuts down the remote computer.

/m \\ComputerName

Specifies the destination computer.

/c "Comment"

Enables you to comment in detail about the reason for the shutdown. You can use a maximum of 511 characters. Comments must be enclosed in quotation marks.

/d [u|p] xx:yy

Lists the reason for the system restart or shutdown, where xx specifies a major reason number from 0 through 255, and yy specifies a minor reason number from 0 through 65,535.

/force

Forces the computer to shut down if other users are logged in. If this is not used and other users are logged in to the remote computer, the computer will not shut down or restart.

Important

If you force the computer to shut down or restart, logged in users will not have the opportunity to save their work.

/t xxx

Sets the time-out period before the system shuts down or restarts to xxx seconds. The valid range is 0-600, with a default of 30. Using the /t flag implies the /force option.

For more detailed information about the shutdown command and additional options, type shutdown /? at the command prompt.

Additional considerations

  • Another way to start Command Prompt is to click Start, click in the Start Search box, type cmd, and press ENTER.

  • The Remote Registry service must be enabled on the remote computer for Shutdown Event Tracker to record information.

  • To shut down or restart a remote computer, the Remote Administration and Windows Management Instrumentation firewall exceptions must be enabled on the remote computer.

Additional references

  • Work with Shutdown Event Tracker

  • Shutdown Event Tracker Overview

  • Enable the Remote Registry Service

  • Command-line syntax notation


Cancel a Restart or Shutdown

Membership in the local Users group, or equivalent, is the minimum required to complete this procedure.

To cancel a restart or shutdown

  1. Open Command Prompt.

  2. Type shutdown /a within the time-out period.

Additional considerations

  • To start Command Prompt, click Start, click All Programs, expand Accessories, and click Command Prompt.

  • Another way to start Command Prompt is to click Start, click in the Search box, type cmd, and press ENTER.

  • For more information about the shutdown command, type shutdown /? at a command prompt.

  • You cannot cancel a restart or shutdown using the Shutdown Event Tracker Windows interface. It is only possible to perform this task from the command line.

Additional references

  • Work with Shutdown Event Tracker

  • Shutdown Event Tracker Overview

  • Command-line syntax notation


Document the Reason for an Unexpected Restart or Shutdown of the Local Computer

If Shutdown Event Tracker is enabled and your computer is restarted or shut down without a user entering a reason, the first member of the local Users group to log in after the restart is prompted to enter a reason for the event.

Membership in the local Users group, or equivalent, is the minimum required to complete this procedure.

Document the reason for an unexpected restart or shutdown of the local computer

  1. Select a reason from the Why did the computer shut down unexpectedly drop-down list.

  2. If your organization uses a trouble ticketing system, you can enter a Problem ID to help your system administrator track the issue.

  3. If a comment is required for the reason you selected in Step 1, you must enter text in the box before you click OK.

  4. When you have finished entering information, click OK.

Additional considerations

  • As a best practice, use standard reasons when recording information in Shutdown Event Tracker. This makes it easier to review historical trends.

Additional references

  • Work with Shutdown Event Tracker

  • Shutdown Event Tracker Overview


Document the Reason for the Unexpected Restart or Shutdown of a Remote Computer

You can document the reason for an unexpected restart or shutdown of a remote computer without logging on locally to that computer. In order to use this feature, the Remote Registry service must be enabled on the remote computer. See Enable the Remote Registry Service for more information.

Membership in the Administrators group, or equivalent, on the remote computer is the minimum required to complete this procedure.

  • Using the Windows interface

  • Using a command line

Using the Windows interface

To document the reason for an unexpected restart or shutdown of a remote computer using the Windows interface

  1. Open Command Prompt.

  2. Type shutdown /i to display the Remote Shutdown dialog box (Shutdown.exe).

  3. Under Computers, click Add to enter computer names, or click Browse to open the Find Computers dialog box.

  4. Under What do you want these computers to do, click Annotate Unexpected Shutdown.

  5. Select the appropriate reason for the unexpected shutdown from the list.

    Note

    If a comment is required, the OK button will not be available until you type at least one character in the text box.

Additional considerations

  • To start Command Prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  • Another way to start Command Prompt is to click Start, click in the Start Search box, type cmd, and press ENTER.

  • The Remote Registry service must be enabled on the remote computer for Shutdown Event Tracker to record information.

  • To shut down or restart a remote computer, the Remote Administration and Windows Management Instrumentation firewall exceptions must be enabled on the remote computer.

Additional references

  • Work with Shutdown Event Tracker

  • Shutdown Event Tracker Overview

  • Enable the Remote Registry Service

Using a command line

Membership in the local Administrators group, or equivalent, on the remote computer is the minimum required to complete this procedure.

To document the reason for an unexpected restart or shutdown of a remote computer using the command line

  1. Click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type shutdown /e /m \\ComputerName /c "Comment" /d [u|p] <xx>:<yy> and then press ENTER.

Value Description

/e

Enables you to document the reason for the unexpected shutdown on the remote computer.

/m \\ComputerName

Specifies the destination computer.

/c

Enables you to comment in detail about the reason for the shutdown. You can use a maximum of 511 characters. Comments must be enclosed in quotation marks.

/d [u|p] xx:yy

Lists the reason for the system restart or shutdown, where xx specifies a major reason number from 0 through 255, and yy specifies a minor reason number from 0 through 65,535.

/force

Forces the computer to shut down if other users are logged in. If this is not used and other users are logged in to the remote computer, the computer will not shut down or restart.

Important

If you force the computer to shut down or restart, logged in users will not have the opportunity to save their work.

/t xxx

Sets the time-out period before the system shuts down or restarts to xxx seconds. The valid range is 0-600, with a default of 30. Using the /t flag implies the /force option.

For more detailed information about the shutdown command and additional options, type shutdown /? at the command prompt.

Additional considerations

  • The Remote Registry service must be enabled on the remote computer for Shutdown Event Tracker to record information.

  • To shut down or restart a remote computer, the Remote Administration and Windows Management Instrumentation firewall exceptions must be enabled on the remote computer.

Additional references

  • Work with Shutdown Event Tracker

  • Shutdown Event Tracker Overview

  • Enable the Remote Registry Service

  • Command-line syntax notation


Enable the Remote Registry Service

A registry key value tells Shutdown Event Tracker when to prompt a user for information about an unexpected restart or shutdown. Without remote registry access, Shutdown Event Tracker cannot remotely reset this registry key value after you have provided a reason.

Membership in the local Administrators group, or equivalent, on the remote computer is the minimum required to complete this procedure.

To enable the Remote Registry service

  1. On the computer where you want to record Shutdown Event Tracker data, click Start, click in the Start Search box, type services.msc, and then press ENTER. Microsoft Management Console will start with the Services snap-in open.

  2. In the console pane, right-click Remote Registry and click Start.

Additional considerations

  • You must be a member of the local Administrators group, or equivalent, on the remote computer to complete this procedure.

Additional references

  • Work with Shutdown Event Tracker

  • Shutdown Event Tracker Overview

For more information about using Microsoft Management Console, see http://go.microsoft.com/fwlink/?linkid=70036.


Command-line syntax notation

The following table describes the notation used to indicate command-line syntax.

Notation | Description
Text without brackets or braces | Items you must type as shown
<Text inside angle brackets> | Placeholder for which you must supply a value
[Text inside square brackets] | Optional items
{Text inside braces} | Set of required items; choose one
Vertical bar (|) | Separator for mutually exclusive items; choose one
Ellipsis (…) | Items that can be repeated